feat: add LDAP support and guest user functionality

- Introduced BaseDN configuration for LDAP in the config.
- Enhanced User model to include IsLDAP field.
- Updated database queries to handle LDAP users.
- Implemented GraphQL queries for LDAP browsing and user authentication type.
- Added ACL management for users and groups, including guest user permissions.
- Updated frontend to support LDAP login and guest user login.
- Improved error handling and user feedback in login and ACL management.

backend/internal/auth/auth.go

@@ -57,18 +57,49 @@ func CheckPassword(hashedPassword, password string) error {
 
 // Login authenticates via local DB first, then falls back to LDAP if configured.
 // Returns the session token, the user's role, and any error.
-func (m *Manager) Login(database *db.DB, username, password string) (token, role string, err error) {
-	// Try local account first.
-	user, dbErr := database.GetUser(username)
-	if dbErr == nil {
-		if bcrypt.CompareHashAndPassword([]byte(user.PassHash), []byte(password)) != nil {
-			return "", "", errors.New("invalid credentials")
-		}
-		tok, err := m.createSession(username, user.Role)
-		return tok, user.Role, err
+// password is a SHA-256 hash (for local accounts); ldapPassword is plaintext (for LDAP bind).
+func (m *Manager) Login(database *db.DB, username, password, ldapPassword string) (token, role string, err error) {
+	// Guest login — no password required.
+	if username == "guest" {
+		tok, err := m.createSession("guest", "guest")
+		return tok, "guest", err
 	}
 
-	// If not found locally and LDAP is configured, try LDAP.
+	user, dbErr := database.GetUser(username)
+	if dbErr == nil {
+		// If the account has a local password hash, always authenticate locally.
+		// This ensures admin accounts are never accidentally routed through LDAP,
+		// even if they were also imported from the directory.
+		if user.PassHash != "" {
+			if bcrypt.CompareHashAndPassword([]byte(user.PassHash), []byte(password)) != nil {
+				return "", "", errors.New("invalid credentials")
+			}
+			tok, err := m.createSession(username, user.Role)
+			return tok, user.Role, err
+		}
+		// No local password — must be an LDAP-only account.
+		if user.IsLDAP {
+			m.mu.RLock()
+			cfg := m.cfg
+			m.mu.RUnlock()
+			if cfg == nil || cfg.LDAP.Url == "" {
+				return "", "", errors.New("LDAP not configured")
+			}
+			ldapPwd := ldapPassword
+			if ldapPwd == "" {
+				ldapPwd = password
+			}
+			if err := ldapUserBind(cfg, username, ldapPwd); err != nil {
+				return "", "", errors.New("invalid credentials")
+			}
+			tok, err := m.createSession(username, user.Role)
+			return tok, user.Role, err
+		}
+		// In DB but no password and not LDAP — refuse.
+		return "", "", errors.New("invalid credentials")
+	}
+
+	// User not in DB. If LDAP is configured try a bind with the provided password.
 	m.mu.RLock()
 	cfg := m.cfg
 	m.mu.RUnlock()
@@ -77,7 +108,11 @@ func (m *Manager) Login(database *db.DB, username, password string) (token, role
 		return "", "", errors.New("invalid credentials")
 	}
 
-	if err := ldapUserBind(cfg, username, password); err != nil {
+	ldapPwd := ldapPassword
+	if ldapPwd == "" {
+		ldapPwd = password
+	}
+	if err := ldapUserBind(cfg, username, ldapPwd); err != nil {
 		return "", "", err
 	}
 
@@ -85,6 +120,27 @@ func (m *Manager) Login(database *db.DB, username, password string) (token, role
 	return tok, "user", err
 }
 
+// UserAuthType returns "guest", "ldap", or "local" for the given username.
+// A user with a non-empty pass_hash is always "local", regardless of is_ldap,
+// so that the frontend hashes the password before sending it.
+func UserAuthType(database *db.DB, username string) string {
+	if username == "guest" {
+		return "guest"
+	}
+	user, err := database.GetUser(username)
+	if err != nil {
+		// User not found in DB — assume LDAP so the frontend sends plaintext.
+		return "ldap"
+	}
+	if user.PassHash != "" {
+		return "local"
+	}
+	if user.IsLDAP {
+		return "ldap"
+	}
+	return "local"
+}
+
 // TestLDAP tests an LDAP configuration by performing a service-account bind.
 func TestLDAP(url string, adminUser, adminPassword string) error {
 	l, err := ldap.DialURL(url)
@@ -111,10 +167,14 @@ func ldapUserBind(cfg *config.Config, username, password string) error {
 		}
 	}
 
+	baseDN := cfg.LDAP.BaseDN
+	escaped := ldap.EscapeFilter(username)
+	// Include cn so OpenLDAP entries of the form cn=username are matched too.
+	filter := fmt.Sprintf("(|(uid=%s)(sAMAccountName=%s)(cn=%s))", escaped, escaped, escaped)
 	searchRequest := ldap.NewSearchRequest(
-		"", // Search from root or a specific BaseDN if needed. Assuming root here since URL can contain it, or we rely on LDAP configured properly
+		baseDN,
 		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		fmt.Sprintf("(|(uid=%s)(sAMAccountName=%s))", ldap.EscapeFilter(username), ldap.EscapeFilter(username)),
+		filter,
 		[]string{"dn"},
 		nil,
 	)
@@ -132,7 +192,7 @@ func ldapUserBind(cfg *config.Config, username, password string) error {
 }
 
 // BrowseLDAP returns users and groups from the LDAP server.
-func BrowseLDAP(url string, adminUser, adminPassword string) ([]string, []string, error) {
+func BrowseLDAP(url, baseDN, adminUser, adminPassword string) ([]string, []string, error) {
 	l, err := ldap.DialURL(url)
 	if err != nil {
 		return nil, nil, err
@@ -145,10 +205,11 @@ func BrowseLDAP(url string, adminUser, adminPassword string) ([]string, []string
 		}
 	}
 
-	// Search for Users
+	// Search for Users — cover inetOrgPerson (OpenLDAP), person, user (AD), posixAccount
 	userReq := ldap.NewSearchRequest(
-		"", ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		"(|(objectClass=person)(objectClass=user))",
+		baseDN,
+		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+		"(|(objectClass=inetOrgPerson)(objectClass=person)(objectClass=user)(objectClass=posixAccount))",
 		[]string{"uid", "sAMAccountName", "cn"},
 		nil,
 	)
@@ -165,10 +226,11 @@ func BrowseLDAP(url string, adminUser, adminPassword string) ([]string, []string
 		}
 	}
 
-	// Search for Groups
+	// Search for Groups — cover groupOfNames, group (AD), posixGroup, groupOfUniqueNames
 	groupReq := ldap.NewSearchRequest(
-		"", ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
-		"(|(objectClass=groupOfNames)(objectClass=group))",
+		baseDN,
+		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
+		"(|(objectClass=groupOfNames)(objectClass=group)(objectClass=posixGroup)(objectClass=groupOfUniqueNames))",
 		[]string{"cn"},
 		nil,
 	)